Add a ip.ttl field about arkime HOT 5 CLOSED

The custom-fields section is for adding fields that the UI will show but are added to the session some other way. I will update the doc to make that clear.

Anyway, you would need to either modify capture or write a plugin if you want to collect new data from packets. Or open a feature request.

With ip.ttl specifically we've never added because no one has provided a good description of how they want to use the data and what to do with multiple values. Lets pretend you have a 100 packets in a session and each packet has a different ttl. Would you want to see all 100 values? If so why?

from arkime.

With ip.ttl specifically we've never added because no one has provided a good description of how they want to use the data and what to do with multiple values.

mostly same as with TCP flags, grouped view by value.
unless there is route rebuild TTL usually does not differ much.

Anyway, you would need to either modify capture or write a plugin if you want to collect new data from packets. Or open a feature request.

In our case capture is direct interface or TZSP replay(so interface again). i am fine with plugin or config.
Issue that i did not found info how to add data into all levels.(actually we need same with TCP MSS).

some values may result in spoofing detection or strange behaviour.

So, i will be very obliged if you make guide how to add field on all levels(from capture to interface)

from arkime.

With ip.ttl specifically we've never added because no one has provided a good description of how they want to use the data and what to do with multiple values.

mostly same as with TCP flags, grouped view by value. unless there is route rebuild TTL usually does not differ much.

Not sure what you mean, can you provide an example

Anyway, you would need to either modify capture or write a plugin if you want to collect new data from packets. Or open a feature request.

In our case capture is direct interface or TZSP replay(so interface again). i am fine with plugin or config. Issue that i did not found info how to add data into all levels.(actually we need same with TCP MSS).

You can't do with just config, you will need to modify capture or write a plugin.

Since this is at the packet level you'll need to modify arkime.h and packet.c to start with.

from arkime.

Not sure what you mean, can you provide an example

something like that.

You can't do with just config, you will need to modify capture or write a plugin.

I am fine with both options.

Since this is at the packet level you'll need to modify arkime.h and packet.c to start with.

this is root arkime files, it will mean fork. it is possible to make with just plugin? or parser-plugin?(if possible want to stay without patch to arkime itself)

from arkime.

Ok, so you want a list of unique values and a count of each of those values.

Currently we have no easy way to do that.

this is root arkime files, it will mean fork. it is possible to make with just plugin? or parser-plugin?(if possible want to stay without patch to arkime itself)

You would do a PR and submit it back to the project, you wouldn't have to maintain a fork. To do a plugin you could use arkime_plugins_set_cb and set a ipFunc

from arkime.